--- subcategory: "Elasticsearch" layout: "aws" page_title: "AWS: aws_elasticsearch_domain" description: |- Terraform resource for managing an AWS Elasticsearch Domain. --- # Resource: aws_elasticsearch_domain Manages an AWS Elasticsearch Domain. ## Example Usage ### Basic Usage ```terraform resource "aws_elasticsearch_domain" "example" { domain_name = "example" elasticsearch_version = "7.10" cluster_config { instance_type = "r4.large.elasticsearch" } tags = { Domain = "TestDomain" } } ``` ### Access Policy -> See also: [`aws_elasticsearch_domain_policy` resource](/docs/providers/aws/r/elasticsearch_domain_policy.html) ```terraform variable "domain" { default = "tf-test" } data "aws_region" "current" {} data "aws_caller_identity" "current" {} resource "aws_elasticsearch_domain" "example" { domain_name = var.domain # ... other configuration ... access_policies = < **Note:** You can enable `encrypt_at_rest` _in place_ for an existing, unencrypted domain only if your Elasticsearch version is 6.7 or greater. For lower versions, if you enable `encrypt_at_rest`, Terraform with recreate the domain, potentially causing data loss. For any version, if you disable `encrypt_at_rest` for an existing, encrypted domain, Terraform will recreate the domain, potentially causing data loss. If you change the `kms_key_id`, Terraform will also recreate the domain, potentially causing data loss. * `enabled` - (Required) Whether to enable encryption at rest. If the `encrypt_at_rest` block is not provided then this defaults to `false`. Enabling encryption on new domains requires `elasticsearch_version` 5.1 or greater. * `kms_key_id` - (Optional) KMS key ARN to encrypt the Elasticsearch domain with. If not specified then it defaults to using the `aws/es` service KMS key. Note that KMS will accept a KMS key ID but will return the key ARN. To prevent Terraform detecting unwanted changes, use the key ARN instead. ### log_publishing_options * `cloudwatch_log_group_arn` - (Required) ARN of the Cloudwatch log group to which log needs to be published. * `enabled` - (Optional, Default: true) Whether given log publishing option is enabled or not. * `log_type` - (Required) Type of Elasticsearch log. Valid values: `INDEX_SLOW_LOGS`, `SEARCH_SLOW_LOGS`, `ES_APPLICATION_LOGS`, `AUDIT_LOGS`. ### node_to_node_encryption ~> **Note:** You can enable `node_to_node_encryption` _in place_ for an existing, unencrypted domain only if your Elasticsearch version is 6.7 or greater. For lower versions, if you enable `node_to_node_encryption`, Terraform will recreate the domain, potentially causing data loss. For any version, if you disable `node_to_node_encryption` for an existing, node-to-node encrypted domain, Terraform will recreate the domain, potentially causing data loss. * `enabled` - (Required) Whether to enable node-to-node encryption. If the `node_to_node_encryption` block is not provided then this defaults to `false`. Enabling node-to-node encryption of a new domain requires an `elasticsearch_version` of `6.0` or greater. ### snapshot_options * `automated_snapshot_start_hour` - (Required) Hour during which the service takes an automated daily snapshot of the indices in the domain. ### vpc_options AWS documentation: [VPC Support for Amazon Elasticsearch Service Domains](https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-vpc.html) ~> **Note:** You must have created the service linked role for the Elasticsearch service to use `vpc_options`. If you need to create the service linked role at the same time as the Elasticsearch domain then you must use `depends_on` to make sure that the role is created before the Elasticsearch domain. See the [VPC based ES domain example](#vpc-based-es) above. -> Security Groups and Subnets referenced in these attributes must all be within the same VPC. This determines what VPC the endpoints are created in. * `security_group_ids` - (Optional) List of VPC Security Group IDs to be applied to the Elasticsearch domain endpoints. If omitted, the default Security Group for the VPC will be used. * `subnet_ids` - (Required) List of VPC Subnet IDs for the Elasticsearch domain endpoints to be created in. ## Attribute Reference This resource exports the following attributes in addition to the arguments above: * `arn` - ARN of the domain. * `domain_id` - Unique identifier for the domain. * `endpoint` - Domain-specific endpoint used to submit index, search, and data upload requests. * `kibana_endpoint` - Domain-specific endpoint for kibana without https scheme. * `tags_all` - Map of tags assigned to the resource, including those inherited from the provider [`default_tags` configuration block](https://registry.terraform.io/providers/hashicorp/aws/latest/docs#default_tags-configuration-block). * `vpc_options.0.availability_zones` - If the domain was created inside a VPC, the names of the availability zones the configured `subnet_ids` were created inside. * `vpc_options.0.vpc_id` - If the domain was created inside a VPC, the ID of the VPC. ## Timeouts [Configuration options](https://developer.hashicorp.com/terraform/language/resources/syntax#operation-timeouts): * `create` - (Default `60m`) * `update` - (Default `60m`) * `delete` - (Default `90m`) ## Import In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Elasticsearch domains using the `domain_name`. For example: ```terraform import { to = aws_elasticsearch_domain.example id = "domain_name" } ``` Using `terraform import`, import Elasticsearch domains using the `domain_name`. For example: ```console % terraform import aws_elasticsearch_domain.example domain_name ```